Detailed attack pattern
Log in
An adversary exploits a weakness in authorization to gather system-specific data and sensitive information within a registry (e.g., Windows Registry, Mac plist). These contain information about the system configuration, software, operating system, and security. The adversary can leverage information gathered in order to carry out further attacks.
Last updated
CAPEC-647 (Collect Data from Registries) is a detailed-level attack pattern catalogued by MITRE in the Common Attack Pattern Enumeration and Classification (CAPEC). It describes a recurring method attackers use to exploit software weaknesses.
The phases an attacker typically follows to carry out this attack.
[Gain logical access to system] An adversary must first gain logical access to the system it wants to gather registry information from,
[Determine if the permissions are correct] Once logical access is gained, an adversary will determine if they have the proper permissions, or are authorized, to view registry information. If they do not, they will need to escalate privileges on the system through other means
[Peruse registry for information] Once an adversary has access to a registry, they will gather all system-specific data and sensitive information that they deem useful.
[Follow-up attack] Use any information or weaknesses found to carry out a follow-up attack
What a successful CAPEC-647 attack can achieve.
Read Data
Affects: Confidentiality
The adversary is able to read sensitive information about the system in the registry.
Defenses that reduce the risk of CAPEC-647.
Common questions about CAPEC-647.
An adversary exploits a weakness in authorization to gather system-specific data and sensitive information within a registry (e.g., Windows Registry, Mac plist). These contain information about the system configuration, software, operating system, and security. The adversary can leverage information gathered in order to carry out further attacks.
It typically unfolds over 4 phases. It begins with: [Gain logical access to system] An adversary must first gain logical access to the system it wants to gather registry information from,
Employ a robust and layered defensive posture in order to prevent unauthorized users on your system.
CAPEC-647 exploits 1 CWE weakness, including CWE-285 (Improper Authorization).
MITRE rates CAPEC-647 as Medium severity with medium likelihood of attack.
Attack-pattern data is sourced from the MITRE CAPEC catalog (v3.9). Weakness associations link to the corresponding CWE entries on RadicalNotion.AI.
Track the CVEs and weaknesses attackers exploit with this technique, with AI-written analysis and remediation guidance.